CVE-2026-97341 is a stored DOM-based cross-site scripting vulnerability in the Visitor Traffic Real Time Statistics plugin for WordPress. The vulnerability exists because the plugin's wp_ajax_nopriv_ahcfree_track_visitor endpoint accepts the 'X-Real-IP' HTTP header from unauthenticated requests and stores the entity-encoded payload directly in the database without sufficient input sanitization or output escaping. This enables attackers to inject arbitrary scripts that execute in the context of users visiting the injected pages. The vulnerability affects all versions up to and including 8.16.

An unauthenticated attacker can inject malicious scripts that execute in the browsers of users visiting affected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability has a CVSS 3.1 score of 7.2 (high severity), with network attack vector, low attack complexity, no privileges required, no user interaction needed, and impacts confidentiality and integrity with no impact on availability.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the plugin or restricting access to the vulnerable endpoint if possible. Monitoring vendor channels for updates is recommended.